Hackers Targeting Cisco RV320/RV325 Routers Using New Exploits

guest · Jan 27, 2019

Hackers Targeting Cisco RV320/RV325 Routers Using New Exploits
January 27, 2019
https://www.bleepingcomputer.com/ne...cisco-rv320-rv325-routers-using-new-exploits/

Disclosure of proof-of-exploit code for security bugs in Cisco routers for small businesses prompted hackers to scan for vulnerable devices in an attempt to take full control of them.

Cisco this week announced updates for router models RV320 and RV325 that fix a command injection (CVE-2019-1652) and an information disclosure (CVE-2019-1653) vulnerability; both of them are in the routers' web management interface.
Exploit code available
A hacker chaining the two bugs could target RV320 and RV325 routers available online to obtain hashed access credentials for a privileged account and thus be able to run arbitrary commands as root.

When Cisco released the advisories and firmware updates that correct the problems, the pentesters also released proof-of-concept (PoC) exploit code for the command injection the info disclosure and the data leak.
Click to expand...

guest · Jan 31, 2019

Cisco Router Vulnerability Gives Window into Researchers' World
The research around a recent vulnerability shows how researchers follow leads and find unexpected results
January 31, 2019
https://www.darkreading.com/attacks...-window-into-researchers-world/d/d-id/1333774

The vulnerability itself was given designation CVE-2019-1653. According to the description of the vulnerability, it "…could allow an unauthenticated, remote attacker to retrieve sensitive information."

In a blog post on his research, Rapid7 chief data scientist Bob Rudis noted that he had seen news of the vulnerability's discovery through responsible disclosure on the Full Disclosure mailing list at seclists.org.
One of the things that Rudis found was a discrepancy between the number of affected devices he found and the number that had been reported by researcher Troy Murch on the Bad Packets Report.
Where Murch found "over 9,000" devices, Rudis found nearly 20,000.

As Hart (who was working on the research with Rudis) looked at the data, he found another piece of interface-associated interest: There were duplicate MAC addresses in the vulnerable population of devices [...]
Click to expand...

guest · Mar 28, 2019

Cisco botched patches for its RV320/RV325 routers
March 28, 2019
https://www.helpnetsecurity.com/2019/03/28/cisco-botched-patches-for-its-rv320-rv325-routers/

Cisco RV320 and RV325 WAN VPN routers are still vulnerable to attack through two flaws that Cisco had supposedly patched.
There are still many vulnerable devices
CVE-2019-1652 and CVE-2019-1653 were discovered in September 2018 by security experts from RedTeam Pentesting and disclosed to Cisco, which delivered patches in January 2019.
Unfortunately, the patches did not fix the vulnerabilities, but merely blacklisted the user agent for curl, a command-line tool for transferring data that is used by many popular Internet scanning tools.
Complete fixes are on the way
Cisco has confirmed their findings and has promised to release new, complete fixes by the middle of April 2019.
Click to expand...

guest · Apr 5, 2019

Cisco fixes flaws RV320 and RV325 routers targeted in attacks
April 4, 2019
https://securityaffairs.co/wordpress/83347/security/rv320-rv325-cisco-routers.html

“The initial fix for this vulnerability was found to be incomplete. Cisco is currently working on a complete fix,” reads the security advisory published by Cisco.. “Firmware updates that address this vulnerability are not currently available. There are no workarounds that address this vulnerability.”

The tech giant also confirmed that the flaws have been exploited in attacks in the wild.
On Thursday Cisco announced a new set of security patches for the RV320 and RV325 routers to correctly address the vulnerabilities.
Both vulnerabilities affect Small Business RV320 and RV325 Dual Gigabit WAN VPN routers running firmware versions 1.4.2.15 through 1.4.2.20. Cisco addressed the issues with the release of version 1.4.2.22, Cisco.
Click to expand...

Log in or Sign up

Hackers Targeting Cisco RV320/RV325 Routers Using New Exploits

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hackers Targeting Cisco RV320/RV325 Routers Using New Exploits

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches